IR 05000334/1992025

Insp Repts 50-334/92-25 & 50-412/92-25 on 921026-30.No Violations Noted.Major Areas Inspected:Design & Procedures Used to Mitigate Consequences of Cable Spreading Room Fire

ML20128B627
Person / Time
Site:	Beaver Valley
Issue date:	11/24/1992
From:	Beall J, Durr J NRC OFFICE OF INSPECTION & ENFORCEMENT (IE REGION I)
To:
Shared Package
ML20128B596	List: IR 05000334/1992025 ML20128B591
References
50-334-92-25, 50-412-92-25, NUDOCS 9212040032
Download: ML20128B627 (11)

Text

. . _ - . _ . - ~. - _ . - - - - . - - - _ ..-- .- .--- .

.

.

.

U. S. NUCLEAR REGULATORY COhihilSSION

REGION I

l REPORT NO /92 25

, 50-412/92-25 ,

'

,

DOCKET NO LICENSE NO DPR-66 NPF 73 l

> LICENSEE: Duquesne Light Company One Oxford Center 301 Grant Street Pittsburgh, Pennsylvania 15279 FACILITY NAh1E: Beaver Valley Power Station, Units 1 and 2 INSPECTION AT: Shippingport, Penntylvania INSPECTION DATES: October 26-30,1992 INSPECTORS: David ht. Silk, Operations Engineer ,

hiorris E. Imarowitz, Reacto: Engineer TEAh! LEADER: gAz., ,gs ~ 80 92 ,

s E, Beall, Team Leader, / bate Jaf)

Fng 'ineering Branc" DRS APPROVED BY- dA m) a"

,' cques. Durr, Chief, Engineerihg / Dat6 Branch, Division of Reactor Safety Areas inspectal: Announe- 1 inspection by Region I personnel to review the design and procedures used to mitigate aie consequences of a cable spreading room fir Iffults: Refer to Exceptive summar >

'

G .

,, -iwr-- , , , - ,-y, - ,-u ---.--e-e,--,--.,y- - - - - - -, w --%.- -

--.---m2-- w, .-.%.-. , , .--u,e , we w . ---

- _ _ - _ _ _ _ _ _ _ _ _ _ - _ _ _ _ _ _ .

.

.

EXECUTIVE SUMMARY Inspectors conducted an announced inspection at the lleaver Valley Power Station during the period October 26-30,1992. The inspectors evaluated the adequacy of the installed equipment and procedural guidance to mitigate the effects of a fire postulated in the cable spreading room which is located directly beneath the control roem at either unit. That fire location was selected because it would require evacuation of the control soom, local operation of equipment, and impicmentation of alternate shutdown method Overall, the licensee demonstrated a good safety perspective and sound engineering practic Based upon the sample of design drawings, operating pgcedures and installation details reviewed, the inspectors concluded that the licensee could successfully mitigate a cable spreading room Orc under the postulated conditions. Operators demonstrated, during a simulator scenario, the ability to recognize a cable spreading room fire and the need to abandon the control room to control the plant. The licensee's engineering staff also demonstrated the availability of information tools necessary to identify specific cable routing for equipment potentially available to assist in mitigation and recover The inspectors noted that the progressive loss of indication and control during the simulator scenario was not identifiable as a Orc until receipt of CO2 system discharge actuation alarm That delay emphasizes the importance of the human factors of fire and smoke alarms located on back panels. Those alarms, ncet modeled on the simulator, have rotating red lights and a sound which is different from other alarms that would help operators identify the fir The Beaver Valley Appendix R procedures were detailed and specific. The procedure directed that required safety-related loads for the affected unit be energized on one running emergency diesel generator (EDG). The procedure required operators to prevent the start of the other (non-hardened) EDG, disconnect offsite power, and trip off all emergency core cooling pumps. The final configuration was one which represented an increase in conditional core damage frequency of several orders of magnitude. The procedure, while probably appropriate for a worst case fire, would be fully implemented in other situations where the increase in risk might not be necessar The inspectors identified two unresolved items with respect to DV-1: one involved the B charging pump and the other involved reactor coolant pump (RCP) motor bearing cooling, A loss of coolant accident (LOCA) is not normally postulated during an Appendix R fire scenario. The inspectors noted, however, that only the operation of the B train charging pumps providing RCP seal injection prevented a RCP seal failure LOCA during a BV-1 Appendix R fire. The B charging pump was hardened to survive a cable spreading room fire, but could be replaced indefinitely by tne C charging pump which was not hardened. The acceptability of this operating configuration was unresolved because an Appendix R fire in the BV-1 cable spreading room without the B charging pump available would lead to a RCP seal failure LOCA. The second unresolved item involved the possible loss of RCP motor bearing cooling which is required to preclude bearing damage and a subseq.ient RCP seal failure LOCA. The BV-1 Appendix R procedures allowed the RCPs to continue to operate after motor bearing cooling would have been lost. The acceptability of the time period involved had not been established at the close of the inspectio !

---_-____-

. -, . __ ~ --- . _ - _ - - - - . - ..

.

.

<

1 INTRODUCTION This inspection was conducted at the licaver Valley Power Station by a group of NRC

-

personnel to evaluate the effectiveness of the licensee's design and procedures for mitigaung the risks associated with a fire postulated in either units' cable spreading room. The inspection reviewed three general areas: design and installation of equipment, operations procedures for Orc scenarios, and probabilistic risk assessment of post fire plant condition The regulatory requirements associated with fire protection are provided in 10 CFR 50.48 and 10 CFR 50, Appendix R. In general, in areas important to safety, licensees are required tc, have a fire protection program whose objectives are to prevent fires; to rapidly detect, contiol, and extinguish fires that do occur; and to protect sufficient equipment from any postulated fire to safely shut down the plan .0 DESIGN REVIEW The two llcaver Valley (IIV) units use different design methods to meet Appendix R requirements. The llV-1 (Operating License issued in 1976) approach involved rekicating cable and other steps to " harden" the 11 train of safety related equipment needed to achieve safe shutdown. Operator actions are in disbutad locations and can involve local operation (without contial power) of breakers. The ilV-2 (Operating License issued in 1987) method was centered al,out the addition of a separate shutdown panel which could control necessary hardened A train component The inspector veri 0ed the adequacy of the llV I hardening measures by reviewing the modifications made to achieve Appendix R compliance. Cable rek> cation, fire barriers and train separation were con 0rmed for a samp!c of key 11 train components including the auxiliary feedwater pump, the charging pump and the emergency diesel generator. No deheiencies were identified. The inspector noted that the C charging pump, which could be placed on either safety train, had its 4 kV power cable routed through the cable spreading room which made it vulnerable to a fire at that location (see Section 4.2). Detection liardware Design and installatinn The inspector reviewed the Are detection and Orc protection systems for both Ileaver Valley units. Unit I used a lioneywell system and a Chemtron system for detection and protection, respectively. The lioneywell system incorporated a supervisory control methodology that would annunciate that an unspeciGed detector failure had occurred. Unit 2 used a lioneywell system for detection and a Pyrotronics system for protection. The Pyrotronic system incorporated a supervisory control methodology that annunciated the failed device and the nature of the failur The inspector walked down the Orc detection and fire protection installations and concluded that they were generally acceptabl . - .

_ _ _ _ _ _ _.

.

.

4 Pesign of Renmte Shutslown Methodology 2.2.1 Unit 1 Methodology Unit I design was completed and implemented prior to the issue of 10 CFit 50, Appendix The licensee d:veloped praedures and implemented malifications to meet Appendix 11 requirements. The procedure assumed the loss of the control room as well as the emergency shutdown panel. Thus, to mitigate the Gre, the licensee would manually remove de and ac control power from large circuit breakers and motor control centers. This action was intended to prevent hot shorts or grounds from causing inadvertent breaker or .tlon (see Section 2.3.1).

The licensee also malified the "11" train safety-related electrical system to cope with the consequences of a fire. Malification DCP 556 placed interposing relays between the cable from the cable spreading room and the "11" emergency diesel generator to mitigate hot shorts or grounds and assure generator control. The modification also installed de control power via a route outside the cable spreading room to provide power for 11D0 Beld flash and start functions independent of the cable spreading room. Also, modincations DCP 580 and 667 provided fire wrap on the "11" train charging pump cable (see Section 4.2).

The inspector reviewed selected portions of the mali 0 cation installation, llased on the parts reviewed, the inspector concluded that the installation achieved the required train hardenin .2.2 Unit 2 Methodology Unit 2 bas a auxiliary shutdown panel (ASP). The design electrically isolated the panel from the control room, the cable tunnel, and cab!c spreading room. The inspector reviewed both the design and the installation of the ASP and noted that the ASP used control power from a kication remote from the control room and the cable spreading room. The control functions were also remote from these h> cations. Ilased on the review, the inspector concluded that the ASP met the needs of the operators for the operation of safety related equipment. The inspector noted that manual breaker operation was required to open the nonsafety offsite power supply breakers (see Section 2.3.2). Control Power llot Shorts and Grounds and fireaker Coordination 2.3.1 Unit i Methodology The recthodology used at Unit I to prevent hot shorts and grounds from causing _ inadvertent operation of the equipment needed to mitigate the accident involved specinc procedural step The procedures required the operators to remove control power fuses at the various 4,160 Vac breakers and to operate the breakers manually. The procedures also directed that various de supply buses be de-energized to remove as much de power from the raceway and cable trays as possible, o

- - - _ _ _ _ _ - _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _____ _ _

.

>

[

'

The inspector reviewed the implementation of the de de-energization with respect to Generic Letter 86-10, " Implementation of Fire Protection llequirements." This generic letter required the licensees to consider de hot shorts if the de system had any designed or inadvertent grounds. The inspector noted that, although there had been some grounds on the various de feeders, there was substantial evidence that the licensee had maintained an aggressive grounds program. During the previous twelve months, there had been a relatively low number of grounds. Most grounds were removed within one on two eight hour shifts and the longest duration had been about four days. Based on this review, the inspector concluded that the licensee's present procedure should assure that de hot shorts would not cause inadvertent operation of doenergized equipmen The inspector noted that the licensee's proecdure removed the relay and protection associated with the electrical breakers for the various sources and loads from the EDG to the various loads. This situation could lead to failure of the liDG, breakers, buswork, cables, and equipment if a fault did occur on the bus durii.g the Gre event. Manual breaker operation, potentially introducing such a fault, could represent a signiGeant threat to personnel and

'

equipment. For example, the breaker manufacturer recommended the use of a rope or other distancing lanyard for manual operation, but this recommendation was not generally known to licensee personnel and no such caution was contained in the applicable procedure. The licensee acknowledged the inspector's concern and stated that this area would be reviewe The inspector had no further question .3.2 Unit 2 Methodology Unit 2 procedures directed the use of the ASP for control and indication during a cable spreading room fire event. The inspector reviewed portions of the basic design and concluded that any hot shorts or grounds that occurred in the cable spreading room, tunnel, or control room would not propagate to the ASP functions. Unit 2 procedures did de-energite some breakers manually, and de-energize some de control power, however, the functions that required breaker close action were controlled from the ASP. The problems potentially associated with Unit I breaker (see Section 2.3.1) closing were not likely to exist at Unit 2. Similarly, Unit 2 breaker operation did not represent as great a risk because the electrical isolation of the ASP allowed control power (and therefore breaker protection and coordination) to be retained for closed breakers. Procedures directed the removal of control power from opened breakers, however, so the above concern (see Section 2.3.1) remained if breaker closure would be required for mitigation.

- - - - - - - - _ _ _ _ _ - _ _ - - ___________-_-_____-___ - _________ ______

_. . _ _ _ _ _ _ _ _____ _ _______

.:

.

a- PROCEDURE ItEVIEW

[

&

7 The procedures for achieving safe shutdown following an Appendix R Gre are signincantly different for each lleaver Valley unit. Unit I utilized a dispersed locations approach using B train equipment while Unit 2 had an alternate shutdown panel which controls A train equipment. Both onits used similar initial implementation guidance following the identification of a Ore as provided in Operating hianual (Oht) procedure Oh! 1(2).5 " Alternate Safe Shutdown from Outside Control Room." Walkdown of the Alternate Safe Shutdown Procedure

-

The inspe: tor conducted a walkdown of selected portions of Oh! 1(2).56.C with members of the licensee's staff. The inspector noted that the operators were familiar with the various actions directed by the procedure. Licensed operators received biennial tiaining on Oht 1(2).56.C including complete procedure walkdown. In general, the required steps were adequately described and within the capabilities of the oltrator The Oh! 1(2).56.C procedure directed the local manual operation of 4 kV and 480 V breakers. The inspector was unable to Ond any evidence of training with respect to the potential hazards of such operation, in particular, the breaker vendor recommended the use of a rope or other lanyard to provide distance for the protection of the operator from arcing or o,her energy release. No such caution was contained in the procedures and cognizant licensee personnel were apparently unaware of the vendor recommendation. After discussions with the inspector and confirmation from the vendor, the license stated that training or procedure changes would address this concern. The inspector had no further questions on this ite The walkdown also demonstrated that the RCPs would not be tripped by the operators prior to abandoning the control room. The RCPs would, instead, be de-energized (at step 18) by disconnecting offsite power from the nonsafety 4 kV bus. This delay could impact the BV-1 RCPs because the nonsafety air compressors providing air to the component cooling water (CCW) containment isolation valves would be tripped at the start of the procedure (at step 1).

Closure of the CCW valves would stop c(x) ling of the RCP motor bearings which could degrade and fail the bearings and potentially cause a RCP seal failure LOCA. This item is unresolved pendiag NRC review of evidence demonstrating that the RCP seals would not be damaged prior to turning off the RCPs during an Appendix 11 scenario (50-334/92-25-01).

. . ______________ - _ ___ _- _ - l

_ ___ _ _ _ _ _ _ _ . _ _ _ _ _ _ _ . _ _ _ _ _ _

'

i

!

7 l Simulator Scennrio The inspector utilized th' IW 2 simulator to evaluate the adequacy of the operating procedure, control room information, and control board displays to respond to an Appendix R  :

fire in the cable spreading room. The postulated scenatio involved a Grc which originated in  !

cables directly below the control room feedwater panels. Initial symptoms included failures of ligilts, meters and recorders. Spurious valve motion and component activations were inserted, leading quickly to a reactor trip and eventually to control room abandonment due to a loss of control Initial alarms and actuations were addressed separately by dispatching plant operators to various renote locations to investigate individual component malfuactions. The control room staff verbalized possible causes for the apparently unrelated failures as they became aware that some abnormal situation was developing. The progressive loss of control was ified '

.

as a fire only aften a CO2 actuation alarm was received. (Other smoke and fire dete. don system alarms were not modeled at the simulator).

After the CO2 system actuation alarm, the operators promptly entered the appropriate Appendix R procedure and dispatched the fire brigade. The inspector noted that site procedures required two of the four control room operators to leave the control room and report to the fire brigade manning kication. During this scenario, the two operators (one RO and one SRO)left the control room while controls were progressively deteriorating with a

'

reactor trip imminent. The licensee's fire protection program has been approved by the NRC, but the inspector noted that the departure of half the licensed control room staff in the middle of a plant transient had the potential to impact safety. For example, the remaining  ;

RO was tasked with diagnosing plant conditions as well as manipulating the controls to mitigate the transien The inspector noted that the effects of the fire were extremely dependent on prompt recognition that a fire was the root cause of the many and disparate malfunctions. The ,

significance of the fire identification emphasized the importance of the human factors of the -

detection system alarms. At Beaver Valley, those alarms are located on R back panel but have rotating red lights and a differeat sound than other alarms. These distinctive aspects of the Gre alarms could be very important because the alarm could be initiated in the rniddle of many other alarms involving key safety systems such that it might otherwise not be immediately recognize '

The structure of the Beaver Valley emergency operating procedures (EOPs) represented a -

- potential problem for operators during a fire. The effects of a fire (e.g., reactor trip) could ,

lead operators to enter the EOPs prior to identification of a Gre. Once the fire was identined, operators would need to transition out of the EOPs without solving the symptoms s-

, of the event and enter, instead, the appropriate Appendix R procedures. The EOPs did not -

provide guidance on exiting the EOPs without solving the symptoms, and discussions with- '

operators indicated that this potential problem had not been addressed during trainin F

--y, - , r -g,,,-am..cn,w-a ,e s,_-.,-e-,,-w,wm,v---a ,-~,,,,o y,ww v.a- - ,-c.,,rv, . -, , ,,,,,-w .p,,_m,,mr,v r,.-, av.~,me---, ~

,

_ _ - . _ _

.

.

.

During the simulator scenario, the Appendix R procedure was entered before conditions would have led to use of the EOPs. The cable spreading room fire was confirmed by the fire brigade and, with the continued degradation of plant controls, resulted in the prompt decision to abandon the control room in accordance with the Appendix R procedure. Tbc performance ;

of the simulator crew was very good throughout the scenario ami in accordance with the

>

applicable procedure .0 TECIINICAL SUPPORT Determination of Potentially Available lk inipment ,

The inspector reviewed the information resources that would be used by the licensee to provide design support for mitigation or recovery actions, in particular, the inspector interviewed some of the engineering personnel who would be in the Technical Support Center ,

(TSC) and who would be tasked to assess the availability of certain components. The inspector selected the BV-1 C charging pumps for a detailed review. That pump might be '

needed to prevent a RCP scal failure LOCA during a cable spreading room fire, but an attempt to start the pump by manual breaker closure could potentially cause a station blackout (see Sections 2.3.1 and 4.2).

The TSC personnel were able to generate the circuit routing information for the charging pump including physical cable location. The individuals interviewed did not appear to be certain as to what steps they would recommend prior to trying to close the pump breake The inspector concluded, however, that the necessary information existed to support informed decision making and that the tools necessary to extract this information were available and understood by the engineering personne .2 Renctor Coolant Pump Seal Injection in accordance with 10 CFR 50, Appendix R, nuclear power plant designs and procedures were not required to consider the possibility of a LOCA being initiated independently during a fire. Licensees were required, however, to safely mitigate a fire and achieve safe shutdown. At Beaver Valley, as at many pressurized water reactors, the predominant accident sequence for core damage involves a RCP seal failure LOCA. For that reason, the inspector reviewed licensee measures taken to avoid a RCP seal failure LOCA during a cable spreading room fir One concern was identified with respect to interruption of RCP motor bearing cooling water flow during pump operation (see Section 3.1) After a RCP is secured, continued cooling of the RCP seal remains necessary to prevent a seal failure LCCA. This cooling can be accomplished by either cooling water flow to the RCP thermal barrier heat exchanger or by seal injection from a charging pump. As discussed in Section 3.1, cooling water flow would be interrupted for BV-1 during a cable spreading room fire. This scenario would leave the B charging pump as the only means left preventing a_ RCP seal failure LOC . -- . .-- .. - - - , , x

.

+

The BV 1 modifications made to meet Appendix R (see Section 2.2.1) included hardening the 11 train from the effects of a cable spreading room fire. These hardening measures included the 11 charging pump. The inspector noted, however, that there were no time limits or restrictions on plant operation with the B charging pump not available as long as the C charging pump was operable on the B train 4 kV bus. The C charging pump was not hardened and its 4 kV power cables were routed through the cable spreading room. A cable spreading room fire which began at BV-1 W N D charging pump not available (replaced with the C pump) would cause a RCP seal failure LOCA. The acceptability of this operating condition is unresolved (50-334/92-25-02) pending further NRC revie .3 Probabilistle Risk Assessment Procedure OM 1(2).56.C once entered following identincation of a fire requiring alternate l plant shutdown, directed the removal of all sources of power and the de-energiration of all equipment not specifically used to mitigate the design basis scenario. While this approach met all the applicable regulatory criteria, it appeared to place the plant in a more degraded j condition than might be necessary to successfully mitigate less severe event The inspector used the licensee's Probabilistic Risk Assessment (PRA) to quantify the risk of core damage accepted by the Appendix R procedure to mitigate the perceived risks associated with hot shorts and grounds. The PRA model was used to_ generate core damage frequency values for several different plant conditions. The initial risk associated with a reactor trip j (without failures) was compared with the risk values associated with the plant conditions that

'

would be established by the Appendix R procedure. The procedure steps, which included disabling the non-hardened EDG and disconnecting from offsite power, appeared to increase the conditional core damage frequency by four orders of magnitude. The PRA did not model some risks such as removal of control power and breaker coordination, but overstated other risks (for example, offsite power was not lost by transmission or switchyard failure but by voluntarily opening a breaker). 1 The inspector noted that the procedure de-energized equipment on the basis of what could be taken credit for in meeting regulatory requirements rather than what components might be available during an event. The cognizant licensee engineering personnel stated that the procedure steps were taken so as to minimize the tisks and effects of electrical shorts and grounds. The inspector agreed that procedure DM 1(2).56.C reduced that risk, which was not immediately quantinable, but implicitly accepted an increase in risk (estimated by the PRA at four orders of magnitude) inherent in unavailable equipment instead. The inspector observed that this trade-off in risks warranted further review for possible ways to reduce the level of accepted ris . - - - .- - -

_ . _ ... _ _ . _ _ ... _ _ _ _ _ _. _ _ __ _ _ _ _ _ _ .__ _ _ _ _ . _ _

.

l'

>

,

10 CONCLUlONS Overall, the licensee demonstrated a good safety perspective and sound engineering practic Based upon the sample of design drawings, operating procedures and installation details reviewed, the inspectors concluded that the licensee could successfully mitigate a cable spreading room fire under the postulated conditions. Operators demonstrated, during a simulator scenario, the ability to recognize a cable spreading room fire and the need to abandon the control room to control the plant. The licensee's engineering staff also demonstrated the availability of information tools necessary to identify specific cable routing for equipment potentially available to assist in mitigation and recover Two items remained unresolved at the close of the inspection. The Drst item involved the acceptability of the time period that the Unit i RCPs might be operated without motor

,.

bearing cooling during a fire (see Section 2.3.1). The second item involved the acceptability of Unit 1 operation without the B charging pump available (see Section 4.2).

l

!

f I

!

,

l

,

-. ,r,_-_ _ . - _ _ _ - . . , _m , ,, ..,__,,, , _ _ , , _, ._. . - _ , . , _ _ __ , - . . -

__ - . . . _ _ _ _ . _ _ . _ _ _ _ _ _ _- _ ... _ _ -- _ _ .. . _

,

.

!

.

ATTACllMENT I Persons Contacled J2p.mtene Light Company

'

A. Beckert, Senior Nuc! car Operations Instructor

• T. Burns, Director of Operational Training

• R. Conley, Operations Outage Coordinator (Acting)  :

J. Cunning, Senior Reactor Operator

• ==Dearborn,==

Director of Electrical Engineering (Acting) ,

• F. Etrel, Senior Engineer

• K. Grada, Unit Manager of Quality Services

• K.11alliday, Manager of Nuclear Engineering

• 11. Kahl, Engineer R. Kahler, Simulator Instructor

F. Lipchick, Senior Licensing Supervisor

• J. Maracek, Senior Licensing Supervisor E. McFarland, Simulator instructor

• D. McLaia Technical Service Manager

• S. Nass, Director of Nuclea; and Mechanical Engineering

• T. Noonan, General Manager of Nuclear Operations

K. Ostrowski, Beaver Valley Unit 1 Operations Manager L. Schad, Simulatot Supervisor

• F. Schuster, Beaver Valley Unit 2 Operations Manager

B. Sepelak, Licensing Engineer

• J. Sieber, Vice President, Nuclear Group

D. Spoerry, General Manager of Nuclear Operations Services

• G. Thomas, General Manager of Corporate Nuclear Services

• N. Tonet, Manager of Nuclear Safety R. Worst, Reactor Operator State of Pennsylvania

C. Edwards, Department of Environmental Resources Miclear Regulatory Commission

A. DeAgazio, Senior Project Manager

• G. Edison, Senior Project Manager L. Rossbach, Senior Resident Inspector

P. Sena, Resident Inspector

• Denotes personnel present at the exit meeting on October 30,1992. Other persons were also contacte ,

. - * * + - . --, = - w